Anvilogic Core Detect

Anvilogic serves as my cybersecurity company's platform that provides detection, SIEM support, and SOC investigation, along with the implemented MITRE ATT&CK framework.

A specific example of how I use Anvilogic in my daily work is that it provides threat detection, reports, detailed reports, detection engineering, and threat hunting, which is quite good.

Anvilogic's threat hunting feature has made my work easier because it supports advanced threats and attack scenarios, analyzing across platforms to detect both known and unknown threats, which proves very useful for my organization.

Anvilogic has changed how my team thinks about detection by improving detection engineering, reducing false-positive alerts, and integrating hybrid SIEM and data lake architectures, and so far, it has been beneficial.

What surprised me the most about Anvilogic once I started using it is the automation capability, which automatically detects and investigates threats such as malware and provides us with reports, making the automation aspect very strong in this software.

Since onboarding, my usage has evolved. During the first 90 days, the software wasn't configured properly, and we were just understanding its basics. As use cases increased daily, we altered and modified some policies and rules to reduce false-positive reports.

Anvilogic's best features are detection, SIEM support that is logged into the SIEM, AI detection in the SOC workflow, as well as threat detection and correlation of that particular software.

Anvilogic's AI detection in the SOC workflow stands out compared to other solutions I've tried because the accuracy of the AI makes it the best software for my organization. The AI agent assists with detection and threat creation, analyzes behaviors, and triggers alerts if any suspicious behavior occurs, along with investigation and MITRE ATT&CK mapping, which helps me significantly.

Anvilogic has positively impacted my organization by helping with both known and unknown threats already present in the current threat landscape, detecting SIEM tools such as Splunk, Microsoft Sentinel, Snowflake, and Databricks, optimizing those tools, and strengthening my organization in the cybersecurity realm.

I have seen a reduction in response time as a specific outcome. Due to SIEM modernization and SOC automation, it has helped me significantly by reducing false-positive reports and alerts.

I chose a nine because, while Anvilogic is excellent, there is room for improvement in terms of the false-positive reports that have been presented and the AI pattern that can be improved.

I have been using Anvilogic for three years.

Anvilogic is quite stable.

On a scale of one to ten, I would rate Anvilogic's scalability as a nine.

The customer support of Anvilogic is good and quite responsive.

We did not previously use any different solution and directly switched to Anvilogic.

Before choosing Anvilogic, we did not evaluate other options and directly purchased it from a vendor who offered it to improve our organization's capabilities. After trying it for two years, it has been working well.

I am from the technical department, so I do not have details about pricing, setup cost, or licensing, as that was handled by my management team.

I am not certain about return on investment, but I can say it is meeting what I needed and what is necessary for the organization.

I am from the technical department, so I do not have details about pricing, setup cost, or licensing, as that was handled by my management team.

We did not previously use any different solution and directly switched to Anvilogic. Before choosing Anvilogic, we did not evaluate other options and directly purchased it from a vendor who offered it to improve our organization's capabilities. After trying it for two years, it has been working well.

My advice to others looking into using Anvilogic is that they should try it at least once by conducting a proof of concept, and if their use cases are met, they can proceed with confidence.

When other teams ask about Anvilogic, I tell them it has helped significantly and has reduced work in reporting and investigation within my organization since adoption.

I have not considered what would break first if Anvilogic disappeared, but I would say the automation capability and reporting would negatively impact my organization.

Looking 12 months ahead, I see Anvilogic playing a bigger role as features evolve rapidly. Any improvements in false-positive reports or new features would definitely enhance its role in my organization.

The need for something better was triggered by the various threats present in the world, which needed to be improved and detected. For that reason, we chose to purchase this software, and having worked on it for the past two years, it satisfies our organizational use cases.

I rate this review a nine overall.

Anvilogic serves as our main SIEM and detection engineering platform. We use Anvilogic to create alerts based on our data, and the AI capability to detect alerts based on whatever data we are feeding into it is a feature that our team at Kroll particularly values.

We have SentinelOne data, which is our EDR, and we have EDR data directly set up through Anvilogic input without using any third-party tool to get that data. Anvilogic has integrations directly in place, and we are using the SentinelOne input through Anvilogic. Since we uploaded or ingested that data, Anvilogic has started to give us suggestions about what alerts could be fired through that data. Anvilogic has flagged the threat identifiers through which we can build some use cases or modify them for our use. Anvilogic has also helped us understand what is a false positive and what could be a promising use case for our company in particular, providing valuable support.

Regarding how Anvilogic supports our detection engineering, the uniqueness is about AI, which we did not have in Splunk earlier. This helps us not only to close the false positives but also features AI to write our queries. This capability lifts a lot of burden from the SOC team as they do not have to focus on how to write a query but can concentrate on investigating an alert or a use case, which has really caught my eye, and I am glad we have onboarded that feature.

Anvilogic has positively impacted our organization with a significant decrease in false positives and providing the independence of multiple data repositories, allowing us the choice of having different repositories. This flexibility enhances our operational efficiency, and the AI also assists with writing queries, making it scalable and cost-effective as we can adjust according to our needs.

The best features that Anvilogic offers include its independence from a particular solution, allowing us to have Snowflake as a data repository now and the flexibility to move to other platforms such as Databricks or Splunk while keeping our detections intact. Another valuable feature is the AI capability, which not only assists in detection but also helps us to write queries, completing multiple tasks efficiently. Additionally, Anvilogic is a no-code platform, so the base search is already ready for us, and we just have to tweak it according to our use cases. Anvilogic's new features enable us to improve SOC efficiency and filter out a lot of false positive alerts. Additionally, it has an attached MITRE framework, automatically detecting it so we do not have to manually add the MITRE framework IDs as we did in Splunk.

Among those features, the one that has made the biggest difference for our team is the AI capability; we have seen a significant shift in our SOC operations. Many false positives are handled by the AI, allowing the team more time to discuss and investigate the actual use cases. Each use case also includes a description of what it is trying to detect, which helps engineers understand the use case's purpose without needing to reach out to seniors for clarification.

Currently, there is a limitation of 100 inputs in Anvilogic integrations, which is less than our needs, making it a challenge to fit all our inputs. Additionally, I believe the documentation should be publicly accessible. We work with different teams to get the data, but since the documentation is not available to everyone, we often have to explain how to make integrations. Also, there are features that do not work as expected; for example, we recently tried to ingest an AWS CloudTrail input to which Anvilogic could not accept any more data past a certain point, forcing us to look for alternatives. We have found that data mapping is sometimes not adequate, as it can only parse JSON data, contrary to the documentation suggesting that CSV or XML formats are acceptable, which has caused issues.

I have been working in my current field for three years, and it has been one year that we have moved to Anvilogic. Prior to that, we were using Splunk as our data ingestion platform and as well as SIEM.

Anvilogic is somewhat stable. Regarding data inputs, we have had issues, but in terms of downtime, we have not experienced any.

Anvilogic is quite scalable, allowing us to significantly lower storage and processing costs compared to legacy SIEM-only approaches. Thanks to having a different data repository, we do not crowd Anvilogic with data and accordingly adjust it to our specific needs.

Customer support is generally good, though we sometimes have to wait longer for answers, which can be a bit frustrating, but overall the support is satisfactory.

Positive

We were previously using Splunk and decided to switch due to its lack of AI capabilities related to the SIEM product. We also evaluated other options before settling on Anvilogic.

The AI capabilities mentioned on Anvilogic's website are indeed good and promising; however, there are areas that require work, particularly concerning data ingestion. Users may encounter roadblocks while integrating inputs, as we faced significant delays due to data input inconsistencies.

Initially, the triage piece was not integrated into Anvilogic's UI, but since its integration, it has helped the team to easily check the triage dashboard and assess current use cases, encouraging us to continue seeking new ways to use it more efficiently.

The moment we realized we needed something better was triggered by Splunk's lack of AI integration, which prompted my manager to consider Anvilogic due to its promising AI features. Since onboarding, we have evolved to remove false positives effectively, which was a challenge with Splunk, allowing for fewer alerts due to Anvilogic's capabilities. Additionally, we no longer need to be dependent on a particular data repository, benefiting from the flexibility that Anvilogic provides.

I rate Anvilogic a six out of ten. I chose a six out of ten for Anvilogic because, despite the impressive detection capabilities and intriguing features, I still see a need for improvement with the data ingestion process. If the data is not ingested properly, the detections could be compromised. While it excels at detection and offers good use cases, my personal experiences with certain problems influenced the decision to rate it just above average.